en-coinbase[.]created[.]app

The domain en-coinbase.created.app was registered on July 12, 2023 through Tucows Domains Inc. and resolves to the IP address 216.150.1.193, which belongs to Amazon.com, Inc. (AS16509) in the United States. DNS resolution is handled by ns1.vercel-dns.com and ns2.vercel-dns.com, indicating the site was hosted on the Vercel platform. A Let’s Encrypt R13 certificate secures the site, and HTTP responses return a 404 status code, suggesting the content is either removed or intentionally hidden. The page title observed during the brief scan reads "💰 Coinbase Wallet Extension | Secure Web3 Crypto Wallet 🔐," directly referencing Coinbase and implying a crypto‑wallet offering.

Google Safe Browsing has flagged the domain for social engineering, and the site appears on a single security blocklist. VirusTotal analysis shows 11 of 95 security vendors label the domain as malicious, and PhishDestroy has also blocked it. The intelligence categorises the activity as a brand‑impersonation crypto scam targeting Coinbase users. While the site is currently offline, the infrastructure components—Vercel hosting, Amazon AS, and a valid TLS certificate—provide a credible veneer that could be re‑activated quickly.

Defenders should ensure that network perimeter controls block traffic to 216.150.1.193 and that DNS filtering policies deny resolution of en-coinbase.created.app. Email security gateways should reference the Google Safe Browsing and VirusTotal findings to quarantine any messages containing this URL. Continuous monitoring of the domain’s registration and certificate status is advised, as changes may indicate a resurgence of the impersonation campaign.